Google and the wrongly jailed Indian Net surfer

An Indian man was recently arrested and held for more than three weeks based in incorrect IP information given to the police by his ISP. The original IP address had been provided by Google, as the "crime" of insulting a historical figure, occurred on Orku

Normally, this wouldn't be a press-worthy story. After all, India is not the first country to take a hard line against Internet free speech. The Thai military regime blocked the entire YouTube Web site earlier this year after a single video posted to the site depicted a woman's feet touching the head of the country's king. Likewise, Turkey also recently blocked YouTube for a video insulting the country's founder.

So what makes this interesting? First, Mr. Kailash was alleged to have posted the pictures to Orkut, Google's redheaded stepchild of a social-networking site. Once Google divulged the IP address of the photo-uploader to the Indian authorities, the police sought the customer's identity from Airtel, one of the country's main telecommunication companies. This is where things get interesting. It turns out that the ISP gave the police the wrong information, and after three weeks behind bars, Mr. Kailash was released.

When contacted for comment, a Google spokesperson told me that, "Google has very high standards for user privacy and a clear privacy policy, and authorities are required to follow legal process to get information. In compliance with Indian legal process, we provided Indian law enforcement authorities with IP address information of an Orkut user." This was the only comment that Google's PR people would give me in response to a lengthy set of questions that I sent over. In particular, I asked if they had received a court order for the information, or merely a polite request from the police. Their response leaves things very hazy.

So what are the lessons to learn from this incident?

Given that Mr. Kailash didn't actually post the photos, I can't provide him with any advice for protecting his privacy on the Internet. All I can suggest is that he hire a very good lawyer, and attempt to take Airtel to the cleaners. If we assume, however, that Airtel eventually handed over the identity of the real "criminal," then perhaps some advice can be offered.

Internet crackdowns: First China, India next?
ItzaFineDay / Flickr

Internet users: If you live in a country that does not respect freedom of speech and where you can get jailed for posting social commentary or otherwise subversive information to the Internet, technology can help you. Likewise, if you live in a country where the major telecom companies have willingly (and for a good profit) sold out their customers' privacy to large-scale illegal government surveillance, privacy-enhancing technologies can keep you safe.

The most important utility in any privacy-concerned Internet user's toolbox should be Tor, an anonymizing Web proxy. Based on technology originally designed by the U.S. Naval Research Labs, funded at one point by the Electronic Frontier Foundation and later by Voice of America, Tor has support from a strange yet wide variety of private and public groups. The EFF has published a guide to blogging anonymously, which is primarily based on Tor. Simply put, had the Indian Orkut user signed up for his account and posted the insulting photographs using Tor, neither he nor any other innocent Airtel customers would be locked up.

While this incident didn't come anywhere close to dissidents fighting for democracy, some strong parallels can be drawn between Google's decision to hand over IP addresses to Indian police, and that of Yahoo, which has handed over the IP addresses of pro-democracy activists to the Chinese authorities on multiple occasions. As a result of the company's snitching, Yahoo is facing a lawsuit, and a U.S. congressman has proposed legislation to make the company's actions illegal. Interestingly, the Global Online Freedom Act, which was proposed by Representative Christopher Smith (R-NJ) in 2006, could also cause problems for any future India-based snitching by Google, should it ever become law.

The bill, if passed into law, would prohibit any U.S. Internet company from providing any foreign official of an Internet-restricting country information that "personally identifies a particular user...except for legitimate foreign law enforcement purposes as determined by the Department of Justice." Companies that violated this prohibition could be sued in U.S. courts by those foreigners whose information they divulged. Fortunately for the Internet giants, the bill has been stuck in committee since 2006 and doesn't show any signs of life.